{"record":{"id":"42ed95859802e237","repo":"apache/hadoop","slug":"both-global-key-and-encryption-context-are-set-on","errorCode":null,"errorMessage":"Both global key and encryption context are set, only one allowed","messagePattern":"Both global key and encryption context are set, only one allowed","errorType":"exception","errorClass":"PathIOException","httpStatus":null,"severity":"critical","filePath":"hadoop-tools/hadoop-azure/src/main/java/org/apache/hadoop/fs/azurebfs/AzureBlobFileSystemStore.java","lineNumber":1883,"sourceCode":"      tokenProvider = (AccessTokenProvider) providers[0];\n      sasTokenProvider = (SASTokenProvider) providers[1];\n      ExtensionHelper.bind(tokenProvider, uri,\n          abfsConfiguration.getRawConfiguration());\n    } else {\n      LOG.trace(\"Fetching token provider\");\n      tokenProvider = abfsConfiguration.getTokenProvider();\n      ExtensionHelper.bind(tokenProvider, uri,\n          abfsConfiguration.getRawConfiguration());\n    }\n\n    // Encryption setup\n    EncryptionContextProvider encryptionContextProvider = null;\n    if (isSecure) {\n      encryptionContextProvider =\n          abfsConfiguration.createEncryptionContextProvider();\n      if (encryptionContextProvider != null) {\n        if (abfsConfiguration.getEncodedClientProvidedEncryptionKey() != null) {\n          throw new PathIOException(uri.getPath(),\n              \"Both global key and encryption context are set, only one allowed\");\n        }\n        encryptionContextProvider.initialize(\n            abfsConfiguration.getRawConfiguration(), accountName,\n            fileSystemName);\n      } else if (abfsConfiguration.getEncodedClientProvidedEncryptionKey() != null) {\n        if (abfsConfiguration.getEncodedClientProvidedEncryptionKeySHA() == null) {\n          throw new PathIOException(uri.getPath(),\n              \"Encoded SHA256 hash must be provided for global encryption\");\n        }\n      }\n    }\n\n    LOG.trace(\"Initializing AbfsClientHandler for {}\", baseUrl);\n    this.clientHandler = new AbfsClientHandler(baseUrl, creds,\n        abfsConfiguration,\n        tokenProvider, sasTokenProvider, encryptionContextProvider,\n        populateAbfsClientContext());","sourceCodeStart":1865,"sourceCodeEnd":1901,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-tools/hadoop-azure/src/main/java/org/apache/hadoop/fs/azurebfs/AzureBlobFileSystemStore.java#L1865-L1901","documentation":"On secure (https) connections ABFS supports two mutually exclusive client-side encryption mechanisms: the global client-provided encryption key (fs.azure.encryption.encoded.client-provided-key plus its -sha property) and the per-file encryption-context provider (fs.azure.encryption.context.provider.type). During client initialization, if both a provider and a global key are configured, PathIOException 'Both global key and encryption context are set, only one allowed' is thrown and the filesystem fails to initialize.","triggerScenarios":"A secure abfss:// mount with both fs.azure.encryption.context.provider.type and fs.azure.encryption.encoded.client-provided-key (or -sha) set - including via account-specific overlays in the same config.","commonSituations":"Rolling out the newer encryption-context feature on clusters that already had client-provided keys; merging encryption sections from different documentation pages; leftover CPPK keys after migrating to the provider model.","solutions":["Choose one mechanism: to use the encryption-context provider, delete fs.azure.encryption.encoded.client-provided-key and fs.azure.encryption.encoded.client-provided-key-sha.","Or remove fs.azure.encryption.context.provider.type to keep the global client-provided key.","Search the full effective config (core-site.xml, account-specific fs.azure.account.* keys, cluster-wide safety valves) for both property families.","Restart services after the change; the check runs only at client construction."],"exampleFix":"<!-- before: both set -> PathIOException -->\n<property><name>fs.azure.encryption.context.provider.type</name><value>my.EncryptionContextProvider</value></property>\n<property><name>fs.azure.encryption.encoded.client-provided-key</name><value>base64key</value></property>\n\n<!-- after: provider only -->\n<property><name>fs.azure.encryption.context.provider.type</name><value>my.EncryptionContextProvider</value></property>","handlingStrategy":"validation","validationCode":"boolean hasProvider = conf.get(\"fs.azure.encryption.context.provider.type\") != null;\nboolean hasCppek = conf.get(\"fs.azure.encryption.encoded.client-provided-key\") != null\n    || conf.get(\"fs.azure.encryption.encoded.client-provided-key-sha\") != null;\nif (hasProvider && hasCppek) {\n  throw new IllegalArgumentException(\"Set either the encryption-context provider or the client-provided key, not both.\");\n}","typeGuard":null,"tryCatchPattern":"try { fs = FileSystem.get(conf); } catch (PathIOException e) { if (e.getMessage().contains(\"only one allowed\")) { /* remove one encryption config family */ } throw e; }","preventionTips":["Model encryption as one active mechanism per account in config management.","When adopting encryption-context, explicitly delete CPPK keys, not just add the provider.","Lint for the forbidden property pair in CI for cluster configs."],"tags":["azure","abfs","encryption","client-side-encryption","configuration","conflict"],"backgroundTag":"conflicting-encryption-config","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}